go-create

go-create

Description

A command-line tool for managing MySQL users, roles, and grants with robust handling of complex passwords and role-based access control. Designed for MySQL 5.7 and 8.0+.

Features

• Create MySQL users and roles
• Manage grants and privileges
• Role-based access control (MySQL 8.0+)
• Support for complex passwords with special characters
• Multiple authentication methods (command line, config file, .my.cnf)
• Google Cloud SQL compatibility
• Secure password handling and validation
• Flexible configuration options

Requirements

• Go 1.20 or higher
• MySQL 5.7 or 8.0+ server
• Admin access to the MySQL server

Installation

# Clone the repository
git clone https://github.com/ChaosHour/go-create.git
cd go-create

# Build the binary
make build

# The binary will be created at bin/go-create

Quick Start

# Create a user with a role and database privileges
go-create --create-user myuser --create-pass "MyP@ssw0rd123!" \
  -r app_read -g select -db myapp

# Show grants for a user
go-create -show-user myuser

# Create a role with specific privileges
go-create -r app_write -g select,insert,update,delete -db myapp

Configuration

You can store your MySQL connection details in a configuration file. By default, the tool looks for .go-create.json in your home directory, or you can specify a different path using the -config flag.

Example configuration file:

{
  "mysql": {
    "host": "192.168.50.50",
    "port": "3306",
    "user": "root",
    "password": "your_password"
  }
}

Credentials precedence:

1. Command line flags (-u, -p, -s)
2. Configuration file specified by -config
3. Default .go-create.json in home directory
4. ~/.my.cnf file

Password Policy

When creating new users with --create-user and --create-pass, passwords must meet these requirements:

• Minimum 30 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one digit
• At least one special character

Note: The password policy ONLY applies to new user creation, not to admin connection credentials.

Forbidden Characters (without -use-sql-file flag)

The following characters can cause issues with MySQL and should be avoided unless using the -use-sql-file flag:

• Single quotes: '
• Double quotes: "
• Backslash: \
• Semicolon: ;
• Double dash: --
• Hash: #
• At symbol: @

Shell-Problematic Characters

These characters may cause issues with command-line MySQL operations (warnings will be shown):

• Dollar sign: $
• Pipe: |
• Ampersand: &
• Angle brackets: < >
• Asterisk: *
• Question mark: ?
• Parentheses: ( )
• Backtick: `
• Space

Bypassing Password Policy

Use -skip-password-policy to bypass validation (use with caution):

go-create --create-user testuser --create-pass "short" -skip-password-policy

For complex passwords with special characters, use the -use-sql-file flag:

go-create --create-user myuser --create-pass "Complex'P@ss\"w0rd!" \
  -use-sql-file -r app_role -db myapp -g select

Usage

go-create -h
  -auth-plugin string
        Force a specific authentication plugin (mysql_native_password or caching_sha2_password)
  -config string
        Path to configuration file
  -create-pass string
        Password for the user being created (subject to password policy)
  -create-user string
        Username to create/modify
  -db string
        Database name
  -debug-password
        Print detailed information about password characters (useful for diagnosing policy failures)
  -g string
        Comma-separated list of grants to create
  -gcp
        Revoke cloudsqlsuperuser role after granting roles (for GCP Cloud SQL)
  -h
        Print help
  -host string
        Host for connection test (with -test-connection)
  -p string
        Password for the admin connection
  -pass string
        Password for connection test (with -test-connection)
  -r string
        Comma-separated list of roles to create
  -s string
        Source Host (MySQL server address)
  -show
        Show grants for specified role (requires -r flag)
  -show-role string
        Show grants for the specified role name
  -show-user string
        Show grants for the specified username
  -skip-password-policy
        Skip password policy enforcement when creating new users
  -test-connection
        Test connection with provided credentials
  -u string
        Username for the admin connection
  -use-sql-file
        Create a temporary SQL file for executing commands (helps with complex passwords)
  -user string
        Username for connection test (with -test-connection)

Examples

1. Creating a user with role and privileges

# Create user 'lisa' with role 'app_write' and specific database privileges
# Password must be 30+ chars with mixed case, digits, and special characters
go-create -s 10.8.0.15 -u admin -p adminpass \
  --create-user lisa --create-pass 'MyStr0ngP@ssw0rd2024!ForLisa#' \
  -r app_write -g select,insert,update,delete -db app_db

2. Creating a role with privileges

# Create role 'app_read2' with SELECT privilege on app_db
go-create -s 10.8.0.15 -u admin -p adminpass -r app_read2 -g select -db app_db

3. Showing user grants

# Show grants for user 'lisa'
go-create -show-user lisa

4. Show role privileges

# Show privileges for a role by name
go-create -show-role app_read

# Or use -show with -r:
go-create -r app_read -show

# Output:
# 2025/02/17 10:33:55 [+] Grants for role app_read:
# 2025/02/17 10:33:55     GRANT USAGE ON *.* TO `app_read`@`%`
# 2025/02/17 10:33:55     GRANT SELECT ON `chaos`.* TO `app_read`@`%`

5. Creating a user with role in Google Cloud SQL

# Create user 'repl' with role 'repl_role', specific database privileges, and revoke cloudsqlsuperuser
# Note: -u and -p are for admin credentials, --create-user and --create-pass are for the new user
go-create -s cloud-sql-instance -u root -p adminpass \
  --create-user repl --create-pass 'Repl!c@t10nP@ssw0rd2024$ecure' \
  -g select,insert,update,delete -db app_db -r repl_role -gcp

# Output will include:
# [+] Created user: repl@%
# [+] Created role: repl_role
# [+] Granted privileges to role: repl_role
# [+] Granted role to user: repl
# [+] Revoked cloudsqlsuperuser role from user: repl@%

GCP note: -u/-p are the admin credentials used to connect. --create-user/--create-pass define the new user. The -gcp flag revokes the automatically-assigned cloudsqlsuperuser role after granting the specified roles.

6. Using credentials from .my.cnf

# Create role 'app_read' with SELECT privilege on chaos database
# No -u/-p/-s flags needed when credentials are in ~/.my.cnf
go-create -r app_read -g select -db chaos

# Output will include:
# [+] Using credentials from .my.cnf
# [+] Connecting to MySQL server at 192.168.50.50:3306 (using .my.cnf)
# [+] Created role: app_read
# [+] Granted privileges to role: app_read

7. Testing a connection

# Verify a newly created user can connect
go-create -test-connection -host 10.8.0.15 -user lisa -pass 'MyStr0ngP@ssw0rd2024!ForLisa#'

8. Creating a user with password, role and privileges

# Create user 'lisa' with password, role 'app_write', and specific database privileges
go-create --create-user lisa --create-pass 'MyStr0ngP@ssw0rd2024!ForLisa#' \
  -r app_write -g select,insert,update,delete -db chaos

# Output:
# [+] Created role: app_write
# [+] Granted privileges to role: app_write
# [+] Created user: lisa@%
# [+] Granted role to user: lisa
# [+] Granted privileges to user: lisa
# [+] Set default role for user: lisa

# Verify role privileges:
go-create -r app_write -show
# [+] Grants for role app_write:
#     GRANT USAGE ON *.* TO `app_write`@`%`
#     GRANT SELECT, INSERT, UPDATE, DELETE ON `chaos`.* TO `app_write`@`%`

# Verify user grants:
go-create -show-user lisa
# [+] Grants for user lisa:
#     GRANT USAGE ON *.* TO `lisa`@`%`
#     GRANT SELECT, INSERT, UPDATE, DELETE ON `chaos`.* TO `lisa`@`%`
#     GRANT `app_write`@`%` TO `lisa`@`%`

Testing the Connection After User Creation

After creating a user, you can test the connection using the MySQL client:

mysql -h <host> -u <new_user> -p

Enter the password when prompted.

Or, using the password file created earlier:

mysql -h <host> -u <new_user> -p"$(< /path/to/password_file.txt)"

Alternatively, you can use the go-create tool's built-in connection test:

go-create -test-connection -user <new_user> -pass "<password>" -host <host>

Validation

❯ mysql -vv -e "source test.sql" 
--------------
show databases
--------------

+--------------------+
| Database           |
+--------------------+
| app_db             |
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
5 rows in set (0.00 sec)

--------------
Select user,host from mysql.user where account_locked ='Y' and password_expired='Y' order by 1
--------------

+------------+------+
| user       | host |
+------------+------+
| app_write  | %    |
| app_write2 | %    |
| read_only  | %    |
+------------+------+
3 rows in set (0.01 sec)

--------------
SELECT user AS role_name FROM mysql.user WHERE host = '%' AND NOT LENGTH(authentication_string)
--------------

+------------+
| role_name  |
+------------+
| app_write  |
| app_write2 |
| read_only  |
+------------+
3 rows in set (0.00 sec)

--------------
SELECT DISTINCT User 'Role Name', if(from_user is NULL,0, 1) Active FROM mysql.user LEFT JOIN role_edges ON from_user=user WHERE account_locked='Y' AND password_expired='Y' AND authentication_string=''
--------------

+------------+--------+
| Role Name  | Active |
+------------+--------+
| app_write  |      1 |
| app_write2 |      0 |
| read_only  |      1 |
+------------+--------+
3 rows in set (0.00 sec)

--------------
SELECT * FROM mysql.role_edges
--------------

+-----------+-----------+---------+---------+-------------------+
| FROM_HOST | FROM_USER | TO_HOST | TO_USER | WITH_ADMIN_OPTION |
+-----------+-----------+---------+---------+-------------------+
| %         | app_write | %       | lisa    | N                 |
| %         | read_only | %       | klarsen | N                 |
+-----------+-----------+---------+---------+-------------------+
2 rows in set (0.00 sec)

--------------
select * from information_schema.user_privileges where GRANTEE='\'mysql.infoschema\'@\'localhost\''
--------------

+--------------------------------+---------------+--------------------+--------------+
| GRANTEE                        | TABLE_CATALOG | PRIVILEGE_TYPE     | IS_GRANTABLE |
+--------------------------------+---------------+--------------------+--------------+
| 'mysql.infoschema'@'localhost' | def           | SELECT             | NO           |
| 'mysql.infoschema'@'localhost' | def           | SYSTEM_USER        | NO           |
| 'mysql.infoschema'@'localhost' | def           | FIREWALL_EXEMPT    | NO           |
| 'mysql.infoschema'@'localhost' | def           | AUDIT_ABORT_EXEMPT | NO           |
+--------------------------------+---------------+--------------------+--------------+
4 rows in set (0.01 sec)

--------------
SELECT user,host FROM mysql.user
--------------

+------------------+-----------+
| user             | host      |
+------------------+-----------+
| app_write        | %         |
| app_write2       | %         |
| chaoshour        | %         |
| johnny5          | %         |
| klarsen          | %         |
| lisa             | %         |
| read_only        | %         |
| root             | %         |
| mysql.infoschema | localhost |
| mysql.session    | localhost |
| mysql.sys        | localhost |
| root             | localhost |
+------------------+-----------+
12 rows in set (0.00 sec)

Bye

Using go-pass to validate

• go-pass

go-pass -s 10.8.0.15 -f show_users.sql -o lisa | sed -e 's/CREATE USER/CREATE USER IF NOT EXISTS/g' -e '/^-- Grants/d' | grep -v 'Dumping' > only-lisa.sql
2023/06/25 10:59:42 [+] Connecting to database: root:root@tcp(10.8.0.15:3306)/mysql

cat only-lisa.sql
-- CREATE USER IF NOT EXISTS for lisa@%:
 CREATE USER IF NOT EXISTS `lisa`@`%` IDENTIFIED WITH 'caching_sha2_password' AS 0x244124303035246B373E322A6C59350A3641206C742E26402B7A2A55726B473177614C6E5A4D71586E55612E776D5937376445434454744A722F76426F67304D4B54686C2E32 DEFAULT ROLE `app_write`@`%` REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT;
 GRANT USAGE ON *.* TO `lisa`@`%`;
 GRANT SELECT, INSERT, UPDATE, DELETE ON `app_db`.* TO `lisa`@`%`;
 GRANT `app_write`@`%` TO `lisa`@`%`;

Example - 2

Create a new role called app_read2 with grants and db:

go-create on  main via 🐹 v1.20.5 
❯ go-create -s 10.8.0.15 -r app_read2 -g select -db app_db                          
2023/06/25 15:22:50 [+] Connecting to database: root:root@tcp(10.8.0.15:3306)/mysql
2023/06/25 15:22:50 [+] Created role: app_read2
2023/06/25 15:22:50 [+] Granted privileges to role: app_read2


Create new user lisa3 and add lisa3 to a default role of app_read2:

go-create on  main via 🐹 v1.20.5 
❯ go-create -s 10.8.0.15 -u lisa3 -p OxFF29szWNQ962hUa0Toez3 -r app_read2            
2023/06/25 15:23:37 [+] Connecting to database: root:root@tcp(10.8.0.15:3306)/mysql
2023/06/25 15:23:37 [!] Role app_read2 already exists
2023/06/25 15:23:37 [+] Created user: lisa3
2023/06/25 15:23:37 [+] Granted role to user: lisa3
2023/06/25 15:23:37 [+] Set default role for user: lisa3



Connect to MySQL 8 and show grants:

go-create on  main via 🐹 v1.20.5 
❯ mysql -u lisa3 -pOxFF29szWNQ962hUa0Toez3

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 216
Server version: 8.0.32-24 Percona Server (GPL), Release 24, Revision e5c6e9d2

Copyright (c) 2000, 2023, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show grants;
+-------------------------------------------+
| Grants for lisa3@%                        |
+-------------------------------------------+
| GRANT USAGE ON *.* TO `lisa3`@`%`         |
| GRANT SELECT ON `app_db`.* TO `lisa3`@`%` |
| GRANT `app_read2`@`%` TO `lisa3`@`%`      |
+-------------------------------------------+
3 rows in set (0.00 sec)

Example - 3

Show grants for an existing user:

❯ go-create -show-user lisa
2023/06/25 15:24:50 [+] Connecting to database: root:root@tcp(10.8.0.15:3306)/mysql
2023/06/25 15:24:50 [+] Grants for user lisa:
    GRANT USAGE ON *.* TO `lisa`@`%`
    GRANT SELECT, INSERT, UPDATE, DELETE ON `app_db`.* TO `lisa`@`%`
    GRANT `app_write`@`%` TO `lisa`@`%`

Real-World Examples with Validation

The following examples were run against a local MySQL 8.0.43 instance and show the actual output at each step.

Example A — Read-only user with role, complex password (sakila)

Create a dev_read role with SELECT on sakila, then create dev_reader1 assigned to that role. The password meets the 30-character policy and contains a special character (^).

go-create -s 127.0.0.1:3306 -u root -p s3cr3t \
  --create-user dev_reader1 \
  --create-pass Xk9mP2nL8qR5vT3wY7uI0oE6sA1cB4dF^ \
  -r dev_read -g select -db sakila

2026/04/27 12:47:15 [+] Connecting to MySQL server at 127.0.0.1:3306 (using command line arguments)
2026/04/27 12:47:15 [!] Pre-validating NEW USER password against policy (min length: 30)...
2026/04/27 12:47:15 [+] New user password pre-validation successful
2026/04/27 12:47:15 [+] Created role: dev_read
2026/04/27 12:47:15 [+] Granted privileges to role: dev_read
2026/04/27 12:47:15 [!] MySQL server version: 8.0.43 (parsed as: 80)
2026/04/27 12:47:15 [!] Using caching_sha2_password for MySQL 8.0+
2026/04/27 12:47:15 [+] Created user: dev_reader1@% with strong password
2026/04/27 12:47:15 [+] Granted role to user: dev_reader1
2026/04/27 12:47:15 [+] Granted privileges to user: dev_reader1
2026/04/27 12:47:15 [+] Set default role for user: dev_read

Verify role grants:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -r dev_read -show

2026/04/27 12:56:47 [+] Grants for role dev_read:
    GRANT USAGE ON *.* TO `dev_read`@`%`
    GRANT SELECT ON `sakila`.* TO `dev_read`@`%`

Verify user grants:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -show-user dev_reader1

2026/04/27 12:56:29 [+] Grants for user dev_reader1:
    GRANT USAGE ON *.* TO `dev_reader1`@`%`
    GRANT SELECT ON `sakila`.* TO `dev_reader1`@`%`
    GRANT `dev_read`@`%` TO `dev_reader1`@`%`

Example B — Write user with role, full DML on chaos

Create app_write_role with SELECT/INSERT/UPDATE/DELETE on chaos, then create app_writer1.

go-create -s 127.0.0.1:3306 -u root -p s3cr3t \
  --create-user app_writer1 \
  --create-pass Mz7nK3pQ9xW2vL5tY8rU1bC4sA6dE0fG^ \
  -r app_write_role -g select,insert,update,delete -db chaos

2026/04/27 12:47:27 [+] Connecting to MySQL server at 127.0.0.1:3306 (using command line arguments)
2026/04/27 12:47:27 [+] Created role: app_write_role
2026/04/27 12:47:27 [+] Granted privileges to role: app_write_role
2026/04/27 12:47:27 [+] Created user: app_writer1@% with strong password
2026/04/27 12:47:27 [+] Granted role to user: app_writer1
2026/04/27 12:47:27 [+] Granted privileges to user: app_writer1
2026/04/27 12:47:27 [+] Set default role for user: app_write_role

Verify role:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -r app_write_role -show

2026/04/27 12:56:47 [+] Grants for role app_write_role:
    GRANT USAGE ON *.* TO `app_write_role`@`%`
    GRANT SELECT, INSERT, UPDATE, DELETE ON `chaos`.* TO `app_write_role`@`%`

Verify user:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -show-user app_writer1

2026/04/27 12:56:29 [+] Grants for user app_writer1:
    GRANT USAGE ON *.* TO `app_writer1`@`%`
    GRANT SELECT, INSERT, UPDATE, DELETE ON `chaos`.* TO `app_writer1`@`%`
    GRANT `app_write_role`@`%` TO `app_writer1`@`%`

Example C — Direct grants only, no role, short password with -skip-password-policy

etl_user needs DML on roll_back with a short internal password. No role is attached.

go-create -s 127.0.0.1:3306 -u root -p s3cr3t \
  --create-user etl_user \
  --create-pass Letmein1! \
  -skip-password-policy \
  -g select,insert,update,delete -db roll_back

2026/04/27 12:48:08 [+] Connecting to MySQL server at 127.0.0.1:3306 (using command line arguments)
2026/04/27 12:48:08 [!] Password policy enforcement disabled
2026/04/27 12:48:08 [!] MySQL server version: 8.0.43 (parsed as: 80)
2026/04/27 12:48:08 [+] Created user: etl_user@% with strong password
2026/04/27 12:48:08 [+] Granted privileges to user: etl_user

Verify — no role grant present, only direct privileges:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -show-user etl_user

2026/04/27 12:56:29 [+] Grants for user etl_user:
    GRANT USAGE ON *.* TO `etl_user`@`%`
    GRANT SELECT, INSERT, UPDATE, DELETE ON `roll_back`.* TO `etl_user`@`%`

Example D — Complex password with quotes via -use-sql-file

ca_svc requires a password containing single quotes and double quotes. The -use-sql-file flag executes statements directly through the Go MySQL driver, bypassing all shell escaping issues.

go-create -s 127.0.0.1:3306 -u root -p s3cr3t \
  --create-user ca_svc \
  --create-pass "C@mp1ex'P@ss\"w0rd!9Tz3Qv8Nm2Lk" \
  -use-sql-file \
  -r ca_rw -g select,insert,update -db analysis

2026/04/27 12:54:35 [+] Connecting to MySQL server at 127.0.0.1:3306 (using command line arguments)
2026/04/27 12:54:35 [!] Pre-validating NEW USER password with relaxed policy (SQL file mode)...
2026/04/27 12:54:35 [+] New user password pre-validation successful
2026/04/27 12:54:35 [!] Using SQL file execution method for complex password handling
2026/04/27 12:54:35 [+] Created role: ca_rw
2026/04/27 12:54:35 [+] Executing 5 statements via Go MySQL driver:
2026/04/27 12:54:35     CREATE ROLE IF NOT EXISTS `ca_rw`
2026/04/27 12:54:35     GRANT select,insert,update ON `analysis`.* TO `ca_rw`
2026/04/27 12:54:35     CREATE USER IF NOT EXISTS 'ca_svc'@'%' IDENTIFIED BY '****MASKED****'
2026/04/27 12:54:35     GRANT `ca_rw` TO 'ca_svc'@'%'
2026/04/27 12:54:35     SET DEFAULT ROLE `ca_rw` TO 'ca_svc'@'%'
2026/04/27 12:54:35 [+] User 'ca_svc' created successfully
2026/04/27 12:54:35 [+] User creation via SQL file completed successfully

Verify role:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -r ca_rw -show

2026/04/27 12:56:47 [+] Grants for role ca_rw:
    GRANT USAGE ON *.* TO `ca_rw`@`%`
    GRANT SELECT, INSERT, UPDATE ON `analysis`.* TO `ca_rw`@`%`

Verify user:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -show-user ca_svc

2026/04/27 12:56:29 [+] Grants for user ca_svc:
    GRANT USAGE ON *.* TO `ca_svc`@`%`
    GRANT `ca_rw`@`%` TO `ca_svc`@`%`

Example E — Standalone role with no user attached

Create a reporting_ro role for future assignment without creating any user account.

go-create -s 127.0.0.1:3306 -u root -p s3cr3t \
  -r reporting_ro -g select -db sakila

2026/04/27 12:54:44 [+] Connecting to MySQL server at 127.0.0.1:3306 (using command line arguments)
2026/04/27 12:54:44 [+] Created role: reporting_ro
2026/04/27 12:54:44 [+] Granted privileges to role: reporting_ro

Verify the role exists with correct privileges:

go-create -s 127.0.0.1:3306 -u root -p s3cr3t -r reporting_ro -show

2026/04/27 12:56:47 [+] Grants for role reporting_ro:
    GRANT USAGE ON *.* TO `reporting_ro`@`%`
    GRANT SELECT ON `sakila`.* TO `reporting_ro`@`%`

Example F — Create a user using a .go-create.json config file

Store admin credentials in .go-create.json so you don't pass -u/-p/-s on every command. When -config is explicitly supplied it takes full precedence over ~/.my.cnf.

{
  "mysql": {
    "host": "127.0.0.1",
    "port": "3306",
    "user": "root",
    "password": "your_admin_password"
  }
}

./bin/go-create \
  -config .go-create.json \
  -create-user analyst6 \
  -create-pass 'MyS3cur3-P4ss!w0rd_G0Create_2026'

2026/05/31 14:40:34 [+] Connecting to MySQL server at 127.0.0.1:3306 (using .go-create.json)
2026/05/31 14:40:34 [!] Pre-validating NEW USER password against policy (min length: 30)...
2026/05/31 14:40:34 [!] Password contains shell-problematic character: '!' which may cause connection issues — consider using -use-sql-file flag (see docs/mysql_password_guidelines.md)
2026/05/31 14:40:34 [+] New user password pre-validation successful
2026/05/31 14:40:34 [+] Created user: analyst6@%

Verify:

mysql --defaults-group-suffix=_primary1 --comments=on -u analyst6 -p

mysql> show grants;
+--------------------------------------+
| Grants for analyst6@%               |
+--------------------------------------+
| GRANT USAGE ON *.* TO `analyst6`@`%` |
+--------------------------------------+
1 row in set (0.002 sec)

Example G — Create a role only (with config file)

./bin/go-create \
  -config .go-create.json \
  -r new_analyst_role \
  -db sakila \
  -g 'SELECT'

2026/05/31 14:41:59 [+] Connecting to MySQL server at 127.0.0.1:3306 (using .go-create.json)
2026/05/31 14:41:59 [+] Created role: new_analyst_role
2026/05/31 14:41:59 [+] Granted privileges to role: new_analyst_role

Example H — Create a new user and new role together (with config file)

A single command creates the role, grants it privileges, creates the user, grants the role to the user, grants direct privileges to the user, and sets the default role — all in one transaction.

./bin/go-create \
  -config .go-create.json \
  -create-user new_analyst \
  -create-pass 'MyS3cur3-P4ss!w0rd_G0Create_2026' \
  -r new_analyst_role \
  -db sakila \
  -g 'SELECT'

2026/05/31 14:42:33 [+] Connecting to MySQL server at 127.0.0.1:3306 (using .go-create.json)
2026/05/31 14:42:33 [!] Pre-validating NEW USER password against policy (min length: 30)...
2026/05/31 14:42:33 [!] Password contains shell-problematic character: '!' which may cause connection issues — consider using -use-sql-file flag (see docs/mysql_password_guidelines.md)
2026/05/31 14:42:33 [+] New user password pre-validation successful
2026/05/31 14:42:33 [!] Role new_analyst_role already exists
2026/05/31 14:42:33 [+] Granted privileges to role: new_analyst_role
2026/05/31 14:42:33 [+] Created user: new_analyst@%
2026/05/31 14:42:33 [+] Granted role to user: new_analyst
2026/05/31 14:42:33 [+] Granted privileges to user: new_analyst
2026/05/31 14:42:33 [+] Set default role for user: new_analyst_role